4000 Router Series Security Configuration Guide

ManualsBrandsHP ManualsNetwork HardwareHP MSR2003 AC Router

• If RADIUS authorization fails, the server sends an error message to the NAS, indicating that the

server itself is not responding.

Configuration procedure

To configure authorization methods for an ISP domain:

Ste

Command

Remarks

1. Enter system view.

system-view N/A

2. Enter ISP domain view.

domain isp-name N/A

3. Specify the default

authorization method for

all types of users.

authorization default { hwtacacs-scheme

hwtacacs-scheme-name [ radius-scheme

radius-scheme-name ] [ local ] [ none ] |

local [ none ] | none | radius-scheme

radius-scheme-name [ hwtacacs-scheme

hwtacacs-scheme-name ] [ local ] [ none ] }

By default, the authorization

method is local.

The none keyword is not

supported in FIPS mode.

4. Specify the command

authorization method.

authorization command { hwtacacs-scheme

hwtacacs-scheme-name [ local [ none ] |

local [ none ] | none }

By default, the default

authorization method is used

for command authorization.

The none keyword is not

supported in FIPS mode.

5. Specify the authorization

method for LAN users.

authorization lan-access { local [ none ] |

none | radius-scheme radius-scheme-name

[ local ] [ none ] }

By default, the default

authorization method is used

for LAN users.

The none keyword is not

supported in FIPS mode.

6. Specify the authorization

method for login users.

authorization login { hwtacacs-scheme

hwtacacs-scheme-name [ radius-scheme

radius-scheme-name ] [ local ] [ none ] |

local [ none ] | none | radius-scheme

radius-scheme-name [ hwtacacs-scheme

hwtacacs-scheme-name ] [ local ] [ none ] }

By default, the default

authorization method is used

for login users.

The none keyword is not

supported in FIPS mode.

7. Specify the authorization

method for PPP users.

authorization ppp { local [ none ] | none |

radius-scheme radius-scheme-name [ local ]

[ none ] }

By default, the default

authorization method is used

for PPP users.

The none keyword is not

supported in FIPS mode.

Configuring accounting methods for an ISP domain

Configuration prerequisites

Before configuring accounting methods, complete the following tasks:

1. For RADIUS or HWTACACS accounting, configure the RADIUS or HWTACACS scheme to be

referenced first. The local and none accounting methods do not require a scheme.

2. Determine the access type or service type to be configured. With AAA, you can configure an

accounting method for each access type and service type.